Re: [tcpdump-workers] VLAN BPF filter

of the filter expression. I mean scopes are separated by brackets. Br, Ambika Prasad Tripathy -Original Message- From: tcpdump-workers-ow...@lists.tcpdump.org [mailto:tcpdump-workers-ow...@lists.tcpdump.org] On Behalf Of sth...@nethelp.no Sent: Monday, August 22, 2011 8:28 PM To: tcpdum

[tcpdump-workers] VLAN BPF filter

Hi, I want to filter packets having VLAN id 7 or VLAN ID 10. Those are not Q-n-Q VLAN ID. So what should be perfect BPF syntax for it. When I tried using below syntax, it results only those packets having VALN ID as 7 and src host 10.21.22.2. ""( ( vlan 7 and src host 10.21.22.2 ) or ( v

[tcpdump-workers] Extending BPF filter in gencode.c of libpcap

Hello Experts, I am trying to extend the BPF filters for few token like GTP-U to filter all mobile IP. For this I have modified gencode.c file after adding one token to filter know as "gtp-u [teid]". This will help then take the mobile ip layer to filter various mobile ip packets. But t

Re: [tcpdump-workers] How to read a big pcap file?

HI, You can split the Big PCAP file and then read those files. If the PCAP file size if bigger then RAM available you may face the problem. You can use editcap utility which is distributed with Wireshark Or You can use tcpdump itself with the -C, -r and -w options Br, Ambika Prasad -Orig

[tcpdump-workers] Working for IP over GTP

Hi Exports, I am new to libpcap/tcpdump application. I am trying to filter IP packets flowing over GTP-U header. If I assume the GTP-U header is only 8 bytes it works fine. But my problem is when GTP-U contains some extra data (gtp header length > 8) how I can determine the start IP header to

Re: [tcpdump-workers] offline packet filtering

Hi, Can I use pcap_compile() on a stream which is opened by using pcap_open_offline(). Br, APT - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

[tcpdump-workers] Getting packet statistics

Hi Experts, I new to the libpcap application. For my application I want to implement one counter for packet statistics for one capture job. But when I search the codes I found in pcap-linux.c pcap_stats_linux() only the filtered packets are displyed by the pcap_stats(). But I want t